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Chapter 1 DHCP-relay Snooping Configuration 


Commands 


The DHCP-relay snooping configuration commands include: 


ip dhcp-relay snooping 

ip dhcp-relay snooping vlan 

ip dhcp-relay snooping database-agent 
ip dhcp-relay snooping db-file 

ip verify source vlan 

ip arp inspection vlan 

ip source binding 

arp inspection trust 

dhcp snooping trust 

ip-source trust 

show ip dhcp-relay snooping 

show ip dhcp-relay snooping binding 
debug ip dhcp-relay snooping 

debug ip dhcp-relay event 


debug ip dhcp-relay binding 


1.1.1. ip dhcp-relay snooping 


Syntax 


To enable or disable the DHCP-relay snooping function in a VLAN, run ip dhcp-relay 
snooping. To resume the corresponding default settings, run no dhcp-relay snooping. 


ip dhcp-relay snooping 


no ip dhcp-relay snooping 


Parameters 


None 


TeleZ 
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Default Value 
The dhcp-relay snooping function is disabled by default. 
Usage Guidelines 
None 
Command Mode 
Global configuration mode 
Example 
The following example shows how to enable the DHCP snooping function: 


Switch_config#ip dhcp-relay snooping 
Switch_config# 


ip dhcp-relay snooping vian 


Syntax 


To configure VLAN of DHCP snooping, run the following command: 
ip dhcp-relay snooping vian vian_id 
To return to the default setting, use the no form of this command. 


no ip dhcp-relay snooping vlan vian_id 


Parameters 


Parameters Description 


vian_id Stands for the ID of a VLAN. Value range: 1-4094 


Default Value 


None 


Command Mode 


Global configuration mode 


TAl33 


DHCP-relay Snooping Configuration Commands 


Usage Guidelines 
This command is used to configure the VLAN of DHCP snooping. 
Example 


The following example shows how to enable snooping detection for DHCP packets on 
VLAN 2. 


Switch_config#ip dhcp-relay snooping vian 2 
Switch_config# 


ip dhcp-relay snooping vian vian_id max-client 


Syntax 


To configure the maxim user number under VLAN of DHCP snooping, run the following 
command. 


ip dhcp-relay snooping vian vian_id max-client number 
To return to the default setting, use the no form of this command. 


no ip dhcp-relay snooping vian vian_id max-client 


Parameters 
Parameters Description 
vian_id Stands for the ID of a VLAN. Value range: 1-4094 
number Allowable maximum number of users: 0-65535 


Default Value 

The default maximum number of users is 65536. 
Command Mode 

Global configuration mode 
Usage Guidelines 


You can use this command to set the maximum users in a VLNA of DHCP snooping. 
During this settings, the principle “first come and first be distributed” will be followed. 
When the number of users in the VLAN reaches the maximum value, new clients are 
then forbidden to distribute. 
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Example 
The following example shows that snooping check will be conducted towards the DHCP 


packets in VLAN2 and the allowable maximum number of users is 3. 


Switch_config#ip dhcp-relay snooping vlan 2 max-client 3 


1.1.4 ip dhcp-relay snooping database-agent 


Syntax 


To bind DHCP snooping to standby TFTP server, run ip dhcp-relay snooping 
database-agent A.B.C.D. 


ip dhcp-relay snooping database-agent A.B.C.D 


no ip dhcp-relay snooping database-agent A.B.C.D 


Parameters 


Parameters Description 


A.B.C.D Means the IP address of the TFTP server. 


Default Value 
There is no standby servers by default. 
Command Mode 
Global configuration mode 
Usage Guidelines 


If the address of the TFTP server is not configured, the binding backup is not 
conducted. 


Example 
The following example shows how to set the address of a server of backing up DHCP 


snooping binding to 192.168.1.1. 
Switch_config#ip dhcp-relay snooping database-agent 192.168.1.1 


1125 
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ip dhcp-relay snooping db-file 


Syntax 


To configure the file name of the bind backup, run the following command: 


ip dhcp-relay snooping db-file name [timestamp] 


To return to the default setting, use the no form of this command. 


no ip dhcp-relay snooping db-file [timestamp] 


Parameters 
Parameters Description 
Name File name which is saved during DHCP snooping binding 
backup. 
timestamp Timestamp which is the file name of the binding backup. 


Default Value 


There is no file. 


Command Mode 


Global configuration mode 


Usage Guidelines 


If the file name is not configured, the binding backup is not conducted. 


Example 


The following example shows how to set the file name of binding backup to 


dhcp_binding.txt. 


Switch_config#ip dhcp-relay snooping db-file dhcp_binding.txt 


ip dhcp-relay snooping write-time 


Syntax 


To configure the time interval of backup binding, run the following command: 


ip dhcp-relay snooping write-time num 
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To return to the default setting, use the no form of this command. 


ip dhcp-relay snooping write-time 


Parameters 


Parameters Description 


Num Stands for the interval of backing up the DHCP snooping binding 
(2-1440). 


Default Value 

The default value of the interval is 30 minutes. 
Command Mode 

Global configuration mode 
Usage Guidelines 


The binding update will be checked during interval configuration. If the binding is 
updated, the binding information need be backed up. 


Example 


The following example shows how to set the interval of backing up the binding to 60 
minutes. 


Switch_config#ip dhcp-relay snooping write-time 60 
Switch_config# 


1.1.7 — ip dhcp-relay snooping write-immediately 


Syntax 


After configuring the entry update, backup the binding table immediately, run the 
following command: 


ip dhcp-relay snooping write-immediately 
To return to the default setting, use the no form of this command. 


no ip dhcp-relay snooping write-immediately 
Parameters 


None 
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Default Value 

None 
Command Mode 

Global configuration mode 
Usage Guidelines 


If there is entry update, it will write into the entry database immediately. It is 
recommended that the function is not enabled when there is plenty of entries. 
Otherwise, the performance may be affected. 


Example 
The following example shows how to backup the binding entry after the configuration is 


updated. 


Switch_config#ip dhcp-relay snooping write-immediately 


1.1.8 ip dhcp-relay snooping log 


Syntax 


To enable log of dhcp snooping, run the following command: 
ip dhcp-relay snooping log 
To return to the default setting, use the no form of this command. 


no ip dhcp-relay snooping log 
Parameters 

None 
Command Mode 

Global configuration mode 
Default Value 


None 
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Usage Guidelines 


After the log function is enabled, the syslog will report if there is packets of dhcp server 
on non-trust port, which indicates that there is illegal dhcp server on the port reporting 
syslog. 


Example 
The following example shows how to enable the DHCP-relay snooping function: 


Switch_config#ip dhcp-relay snooping log 


1.1.9 ip dhcp-relay snooping rapid-refresh-bind 


Syntax 


To enable rapid update of DHCP snooping, run ip dhcp-relay snooping 
rapid-refresh-bind. To return to the default setting, use the no form of this command. 


ip dhcp-relay snooping rapid-refresh-bind 


no ip dhcp-relay snooping rapid-refresh-bind 
Parameters 
None 
Default Value 
None 
Command Mode 
Global configuration mode+ 
Usage Guidelines 


After this function is enabled, the DHCP attack of fake MAC will be closed; when the 
client is allowed to change the access port, the IP address can be directly acquired 
without waiting for the expiration of the IP lease. 


If the client change the access port after the function is disabled, the device enabling 
snooping will take it as dhcp packet attack of fake mac and the dhcp packet will be 
dropped. 
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Example 


The following example shows how to enable dhcp snooping fast update entry. 


Switch_config# ip dhcp-relay snooping rapid-refresh-bind 


1.1.10 dhcp-relay snooping information option 


Syntax 


To configure the way of entering option82, run the following command: 


ip dhcp-relay snooping information option format { snmp-ifindex | manual | 
hn-type [host] | cm-type } 


To return to the default setting, use the no form of this command. 


no ip dhcp-relay snooping information option format { snmp-ifindex | manual | 
hn-type [host] | cm-type } 


Parameters 
Parameters Description 
format snmp-ifindex Fills in option 82 in SNMP ifindex mode (optional). 
format manual Uses the manual configuration to fill in option82 (optional). 
format hn-type [host] Uses the Cisco format to enter option82 (optional). 
Host means the configuration device is the master device. 
format cm-type Enables enter option82 in the format of cm-type (optional) 


Default Value 

Option 82 will not be added to or removed from the report by default. 
Command Mode 

Global configuration mode 
Usage Guidelines 


This command is used to set whether DHCP option82 can be handled when a switch is 
conducting DHCP snooping. If format snmp-ifindex is specified, you should use SNMP 
ifindex to fill in option82; if format manual is specified, you should use the character 
string, which is set by the command “dhcp snooping information circuit-id string” on all 
ports, to fill in the circuit-id option of option82; if specifying format cm-type, filling in 
option82 in the way of option82; in other cases, fill in option82 according to the rules of 
RFC3046. 
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Example 


The following example shows how to fill in option 82 in SNMP ifindex mode. 


Switch_config#ip dhcp-relay snooping 


Switch_config#ip dhcp-relay snooping information option format snmp-ifindex 


The following example shows how to fill in option 82 in manual mode. 
Switch_config#ip dhcp-relay snooping 


Switch_config#ip dhcp-relay snooping vian [WORD] /[[WORD] stands for the vlan 
name for start up the snooping function. 


Switch_config# ip dhcp-relay snooping information option format manual 


1.1.11. ip verify source vlan 


Syntax 


To configure VLAN of IP source address monitored, run the following command: 
ip verify source vlan vianid 
To return to the default setting, use the no form of this command. 


no ip verify source vlan vianid 


Parameters 


Parameters Description 


vian id Stands for the ID of a VLAN. Value range: 1-4094 


Default Value 
None 
Command Mode 
Global configuration mode 
Usage Guidelines 


This command is used to configure a VLAN for monitoring the source IP address. The 
“no” form of this command is used to cancel this VLAN. _ If the source IP address and 
source MAC address of the IP packet is not the client's legal address, which is 
distributed by the DHCP server and listened by DHCP snooping, the vlan in which IP 
source address will take the kind of packets as illegal ones and drop them. 
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Example 


The following example shows how to conduct source IP address monitoring to the 
packets from all physical interfaces (except trusted interfaces) in VLAN2. 


Switch_config#ip verify source vlan 2 


1.1.12 ip arp inspection vlan 


Syntax 


To configure the VLAN which ARP packet source address monitored, run the following 
command: 


ip arp inspection vlan vianid 
To return to the default setting, use the no form of this command. 


no ip arp inspection vlan vianid 


Parameters 


Parameters Description 


vianid Stands for the ID of a VLAN. Value range: 1-4094 


Default Value 

None 
Command Mode 

Global configuration mode 
Usage Guidelines 


This command is used to configure a VLAN for monitoring the source address of the 
ARP packet. The “no” form of this command is used to cancel this VLAN. In the VLAN 
where monitoring the source address of the ARP packets is enabled, if SIP and SMAC 
of a ARP packet, which correspond to the IP address and MAC address of the client 
that the DHCP server distributes to the client, are unsuitable, the ARP packet will be 
dropped. 


Example 
The following example shows how to conduct source address monitoring to the ARP 


packets from all physical interfaces (except trusted interfaces) in VLAN2. 


Switch_config#ip arp inspection vlan 2 
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1.1.13 ip source binding 


Syntax 


To add MAC-to-IP binding to an interface, run ip source binding xx-xx-Xxx-XXx-XX-XX 
A.B.C.D interface name. To return to the default setting, use the no form of this 


command. 


ip source binding xx-xx-xx-xx-xx-xx A.B.C.D interface name vlan vian-id 


no ip source binding xx-xx-xx-xx-xx-xx A.B.C.D vlan vian-id 


Parameters 


Parameters 


Description 


XX-XX-XX-XX-XX-XX 


MAC address 


A.B.C.D 


IP address 


Name 


Means a name of an interface. 


vian-id 


Stands for VLAN ID. 


Default Value 


None 


Command Mode 


Global configuration mode 


Usage Guidelines 
None 


Example 


The following example shows how to bind MAC address 08-00-3e-00-00-01 to IP 
address 192.168.1.2 on interface GigaEthernet0/1. 


Switch_config#ip source binding 08-00-3e-00-00-01 192.168.1.2 interface GigaEthernet0/1 


Switch_config# 


1.1.14 arp inspection trust 


Syntax 


To configure ARP trust port, run the following command: 
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arp inspection trust 
To return to the default setting, use the no form of this command. 


no arp inspection trust 
Parameters 
None 
Default Value 
The default interface is a distrusted one. 
Command Mode 
Interface configuration mode 
Usage Guidelines 


The ARP monitoring is not conducted to the ARP-trusted interface. The “no” form of this 
command is used to configure the default value of this interface. 


Example 
The following example shows how to set interface GigaEthernet 0/1 to an ARP-trusted 


interface. 


Switch_config_g0/1#arp inspection trust 


1.1.15 | dhcp snooping trust 


Syntax 


To configure DHCP trust port, run the following command: 
dhcp snooping trust 
To return to the default setting, use the no form of this command. 


no dhcp snooping trust 
Parameters 


None 
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Default Value 

The default interface is a distrusted one. 
Command Mode 

Interface configuration mode 
Usage Guidelines 


DHCP snooping is not conducted to the DHCP-trusted interface. The “no” form of this 
command is used to resume the default value of this interface. 


Example 
The following example shows how to set interface GigaEthernet 0/1 to a DHCP-trusted 


interface. 


Switch_config_g0/1#dhcp snooping _ trust 


1.1.16 dhcp snooping deny 


Syntax 


To disable dhcp snooping monitoring, run the following command: 
dhcp snooping deny 
To return to the default setting, use the no form of this command. 


no dhcp snooping deny 
Parameters 

None 
Default Value 

Snooping monitoring is allowed on the default interface. 
Command Mode 


Interface configuration mode 
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Usage Guidelines 


After this command is configured, DHCP snooping trust, IP-source trust and ARP 
inspection trust are automatically enabled. The “no” form of this command is used to 
configure the default value of this interface. 


Example 


The following example shows how to disable DHCP snooping on _ interface 
GigaEthernet0/1. 


Switch_config_g0/1#dhcp snooping deny 


1.1.17 | dhcp snooping information circuit-id 


Syntax 


To configure option82 circuit-id sub-option, run the following command: 
dhep snooping information circuit-id {string [STRING] | hex xx-xx-xx-xx-xx-xx} 
To return to the default setting, use the no form of this command. 


no dhcp snooping information circuit-id 


Parameters 


Parameters Description 


string STRING Stands for the character string carried by the sub-option of 
option82 circuit-id. 


hex [Xx-xx-xx-xx-xx-xx] | Stands for the hexadecimal character string carried by the 
sub-option of option82 circuit-id. 


Default Value 

None 
Command Mode 

Interface configuration mode 
Usage Guidelines 


This command can be set on each port that connects the client. This command is used 
to configure option82 of the DHCP packet, which is sent by DHCP client to DHCP 
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server and monitored by DHCP snooping. (the device of manually set optio82 need be 
opened. See the command, ip dhcp-relay snooping information option format manual) 


Example 


The following example shows how to set option82 to group1 manually on interface g0/3, 
which belongs to interface g0/3. 


Switch_config#ip dhcp-relay snooping 

Switch_config#ip dhcp-relay snooping vian 1 

Switch_config#ip dhcp-relay snooping information option format manual 
Switch_config#interface g0/3 


Switch_config_g0/3#dhcp snooping information circuit-id string group 


1.1.18 | dhcp snooping information remote-id string 


Syntax 


To configure the sub-option of Option82 remote-id, run the following command: 
dhcp snooping information remote-id {string [STRING] | hex xx-xx-xx-xx-xx-xx} 
To return to the default setting, use the no form of this command. 


no dhcp snooping information remote-id 


Parameters 
Parameters Description 
string STRING Stands for the character string carried by option82 remote-id. 
Nex XX-XX-XX-XX-XX-XX Stands for the hexadecimal character string carried by the 
sub-option of option82 remote-id. 


Default Value 


None 


Command Mode 


Interface configuration mode 
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Usage Guidelines 


This command can be set on each port that connects the client. This command is used 
to configure option82 of the DHCP packet, which is sent by DHCP client to DHCP 
server and monitored by DHCP snooping. (the switch of manually set optio82 need be 
opened. See the command, ip dhcp-relay snooping information option format manual) 


Example 


The following example shows how to set option82 to group1 manually on interface g0/3, 
which belongs to interface g0/3. 


Switch_config# ip dhcp-relay snooping 

Switch_config# ip dhcp-relay snooping vlan 1 

Switch_config#ip dhcp-relay snooping information option format manual 
Switch_config#interface g0/3 


Switch_config_g0/3# dhcp snooping information remote-id string group1 


1.1.19 | dhcp snooping information vendor-specific 


Syntax 


To configure the sub-option of Option82 verdor-specific, run the following command: 


dhcp snooping’ information § vendor-specific {string [STRING] | hex 
XX-XX-XX-XX-XX-XX} 


To return to the default setting, use the no form of this command. 


no dhcp snooping information vendor-specific 


Parameters 
Parameters Description 
string STRING Stands for the character string carried by option82 
verdor-specific. 
hex XX-XX-XX-XX-XX-XX Stands for the hexadecimal character string carried by the 
sub-option of option82 verdor-specific. 


Default Value 


None 
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Command Mode 
Interface configuration mode 
Usage Guidelines 


This command can be set on each port that connects the client. This command is used 
to configure option82 of the DHCP packet, which is sent by DHCP client to DHCP 
server and monitored by DHCP snooping. (the switch of manually set optio82 need be 
opened. See the command, ip dhcp-relay snooping information option format manual) 


Example 


The following example shows how to use the hexadecimal 
00-00-00-09-0d-01-0b-78-69-61 -6f-6d-69-6e-37-31-31-34 to set option82 option 
vendor-specific (suboption 9) 

Switch_config# ip dhcp-relay snooping 

Switch_config# ip dhcp-relay snooping vlan 1 


Switch_config#ip dhcp-relay snooping information option format manual 


Switch_config#interface g0/3 


Switch_config_g0/3# dhcp snooping information vendor-specific hex 
00-00-00-09-0d-01 -Ob-78-69-6 1-6f-6d-69-6e-37-31-31-34 


1.1.20 dhcp snooping information append 


Syntax 


To enable the append switch of suboption9 in option82, run the following command: 


dhcp snooping information append 


To add first-subop9-param information of suboption9 in option82, run the following 
command: 


dhcp snooping information append first-subop9-param { hex xx-xx-xx-xx-Xxx-xx | 
hostname | vianip } 


To add second-subop9-param information of suboption9 inoption82, run the following 
command: 
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dhcp snooping information append second-subop9-param { hex xx-xx-xx-xX-xXxX-xx 
| hostname | vianip } 


To disable the append switch of suboption9 in option82, run the following command: 


no dhcp snooping information append 


To cancel the first-subop9-param append of suboption9 in option82, run the following 
command: 


no dhcp snooping information append first-subop9-param 


To cancel the second-subop9-param append of suboption9 in option82, run the 
following command: 


no dhcp snooping information append second-subop9-param 


Parameters 


Parameters Description 


first-subop9-param Stands for the Hex system of the first parameter carried by 
hex [xx-xXx-XXx-XX-XX-XX] option82 vendor-specific (suboption9). 


second-subop9-param Stands for the Hex system of the second parameter carried by 
hex [Xx-xXx-XXx-XX-XX-XX] option82 vendor-specific (suboption9). 


hostname Option82 vendor-specific (suboption9 ) Stands for the parameter 
of the suboption is the host name 


vianip Option82 vendor-specific (suboption9 ) Stands for the parameter 
of the suboption is IP of interface vlan 


Default Value 

None 
Command Mode 

Interface configuration mode 
Usage Guidelines 


This command can be set on each port that connects the client. This command is used 
to configure option82 of the DHCP packet, which is sent by DHCP client to DHCP 
server and monitored by DHCP snooping. 
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This command without parameters acts as a switch command. When append is 
enabled, the information of this command will be added to suboption9 of option82. The 
added information is first-subop9-param and second-subop9-param. 


Example 
The following example shows how to enrich dhcp packets with option82 on interface 


g0/3 and set suboption 9 added parameter 1 with the hexadecimal 61-62-63-61-62-63. 


Switch_config_g0/3# dhcp snooping information append 


Switch_config_g0/3#dhcp snooping information append first-subop9-param hex 
61-62-63-61-62-63 


Here 61-62-63-61-62-63 is the Hex system of the to-be-added parameter. 


1.1.21. dhcp snooping information drop 


Syntax 


To drop dhcp packet with option82, run the following command: 
dhcp snooping information drop 
To return to the default setting, use the no form of this command. 


no dhcp snooping information drop 
Parameters 
None 
Default Value 
None 
Command Mode 
Interface configuration mode 
Usage Guidelines 


This command can be set on each port that connects the client. 


After this command is set, the request packets that contain option82 will be dropped on 
the stipulated port. 


Example 


The following example shows how to drop dhcp packets with option82 on g0/3. 
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Switch_config_g0/3# dhcp snooping information drop 


1.1.22  ip-source trust 


Syntax 


To configure IP source address port trust, run the following command: 
ip-source trust 
To return to the default setting, use the no form of this command. 


no ip-source trust 
Parameters 
None 
Default Value 
The default interface is a distrusted one. 
Command Mode 
Interface configuration mode 
Usage Guidelines 


Source IP address snooping is not conducted to the source-IP-trusted interface. The 
“no” form of this command is used to resume the default value of this interface. 


Example 
The following example shows how to set interface GigaEthernet0/1 to a 


source-ip-trusted interface. 


Switch_config_g0/1#ip-source trust 


1.1.23 show ip dhcp-relay snooping 


Syntax 


To show Dhcp-relay snooping configuration information, run the following command: 


show ip dhcp-relay snooping 


21 


DHCP-relay Snooping Configuration Commands 


Parameters 
None 
Default Value 
None 
Command Mode 
Any mode 
Usage Guidelines 
This command is used to display the information about DHCP-snooping configuration. 
Example 
The following example shows how to display the information about DHCP-relay 


snooping. 


Switch_config#show ip dhcp-relay snooping 


1.1.24 — show ip dhcp-relay snooping binding 


Syntax 


To show the port binding information of dhcp-relay snooping, run the following 
command: 


show ip dhcp-relay snooping binding [all] 
Parameters 

None 
Default Value 

None 
Command Mode 


Any mode 
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Usage Guidelines 


This command is used to display the binding information about DHCP-relay snooping. 


If the all parameter is in the command sentence, all binding information about 
DHCP-relay snooping will be displayed. 


Example 
The following example shows how to display the information about DHCP-relay 
snooping binding. 


Switch_config#show ip dhcp-relay snooping binding 


1.1.25 debug ip dhcp-relay snooping 


Syntax 


To enable debug switch of Dhcp-relay snooping,run the following command: 
debug ip dhcp-relay snooping 
To return to the default setting, use the no form of this command. 


no debug ip dhcp-relay snooping 
Parameters 
None 
Default Value 
None 
Command Mode 
Privileged mode 
Usage Guidelines 


This command is used to enable or disable the debugging switch of DHCP-relay 
snooping. 


Example 


The following example shows how to enable the debugging switch of DHCP-relay 
snooping. 
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Switch#debug ip dhcp-relay snooping 
Switch# 


1.1.26 debug ip dhcp-relay event 


Syntax 


To enable event debug switch of dhcp-relay, run the following command: 
debug ip dhcp-relay event 
To return to the default setting, use the no form of this command. 


no debug ip dhcp-relay event 
Parameters 
None 
Default Value 
None 
Command Mode 
Privileged mode 
Usage Guidelines 
This command is used to enable or disable the event debugging switch of DHCP-relay. 
Example 
The following example shows how to enable the debugging switch of DHCP-relay 


event. 


Switch#debug ip dhcp-relay event 
Switch# 


1.1.27 debug ip dhcp-relay binding 


Syntax 


To enable binding debug switch of Dhcp-relay snooping, run the following command: 


debug ip dhcp-relay binding 
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To return to the default setting, use the no form of this command. 


no debug ip dhcp-relay binding 
Parameters 
None 
Default Value 
None 
Command Mode 
Privileged mode 
Usage Guidelines 


This command is used to enable or disable the debugging switch of DHCP-relay 
snooping binding. 


Example 
The following example shows how to enable the debugging switch of DHCP-relay 


snooping binding. 


Switch#debug ip dhcp-relay binding 


1.1.28 debug ip dhcp-relay all 


Syntax 


To enable the debug switch of all Dhcp-relay, run the following command: 
debug ip dhcp-relay all 
To return to the default setting, use the no form of this command. 


no debug ip dhcp-relay all 
Parameters 


None 
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Default Value 
None 
Command Mode 
Privileged mode 
Usage Guidelines 
The command can be used to enable/disable the debug switch of all dhcp-relay. 
Example 
The following example shows how to enable all debug switches of dhcp-relay, run the 


following command: 


Switch# debug ip dhcp-relay all 
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